UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



ELECTRONIC PRIVACY INFORMATION CENTER 
1718 Connecticut Ave., N.W. 
Suite 200 

Washington, DC 20009 
Plaintiff, 



v. 



THE FEDERAL TRADE COMMISSION 
600 Pennsylvania Avenue, N.W. 
Washington, D.C. 20580 

Defendant. 



Civil Action No. 



COMPLAINT FOR INJUNCTIVE RELIEF 

1 . This is an action under the Administrative Procedure Act ("APA"), 5 U.S.C. § 
706(1), to compel agency action unlawfully withheld. 

2. Plaintiff seeks injunctive and other appropriate relief compelling the Federal 
Trade Commission to enforce the October 13, 201 1 consent order in the matter captioned In the 
Matter of Google, Inc., FTC File No. 102 3136. 

Jurisdiction and Venue 

3 . This Court has subj ect matter jurisdiction over this action and personal jurisdiction 
over the parties pursuant to 5 U.S.C. §§ 702-3. This Court also has jurisdiction over this action 
pursuant to 28 U.S.C. § 1331. Venue is proper in this district under 5 U.S.C. § 703. 
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Parties 

4. Plaintiff the Electronic Privacy Information Center ("EPIC") is a public interest 
research organization incorporated as a not-for-profit corporation in Washington, D.C. EPIC was 
established in 1994 to focus public attention on emerging civil liberties issues and to protect 
privacy, the First Amendment, and other Constitutional values. 

5. Defendant United States Federal Trade Commission ("FTC") is an independent 
commission established in the Executive Branch of the United States Government. The FTC is an 
agency within the meaning of 5 U.S.C. § 701(b)(1). 

Facts 

6. This action arises from Google, Inc.'s imminent violation of a consent order with 
the FTC. 

7. An October 13, 201 1 consent order bars Google from misrepresenting the 
company's privacy practices, requires the company to obtain users' consent before disclosing 
personal data, and requires the company to develop and comply with a comprehensive privacy 
program. 

8. The FTC consent order arises from a complaint filed by EPIC with the 
Commission on February 6, 2010. 

9. In January 2012, Google announced that it would change its terms of service for 
current users of Google services and consolidate users' personal information across more than 60 
Google services in clear violation of its prior commitments to the Federal Trade Commission. 

10. The change will become effective on March 1, 2012. 

1 1 . The Federal Trade Commission has a non-discretionary obligation to enforce a 
final order. 
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12. The FTC has thus far failed to take any action regarding this matter, placing the 
privacy interests of literally hundreds of millions Internet users at grave risk. 

13. EPIC brings this Administration Procedure Act suit to require the Commission to 

enforce the consent order. 

Google Engaged in Unfair and Deceptive Trade Practices that Disclosed Consumers' 

Personal Information Without Consent 

14. On Tuesday, February 9, 2010, Google attempted to launch a social networking 
service, Google Buzz. 

15. As part of this attempt, Google took information that users provided for Google 
electronic mail service Gmail and used it to populate Buzz, a separate and discrete social 
network service. 

16. Google transferred the data of the users of Gmail even in those circumstances 
where users purposefully chose not to sign up for the social network services. 

17. Google did not adequately communicate that, as a result of these action, Google 
would make public certain private information by default; options for controlling this 
information, as the Federal Trade Commission subsequently determined, were "confusing and 
difficult to find." 

18. With the attempted introduction of Buzz, Google disclosed personal information, 
such as email addresses, without consumers' permission. 

19. In some cases, Google's disclosure made public lists of followers and people to 
follow that included abusive ex-husbands, clients of mental health professionals or attorneys, and 
others. 

20. As the Federal Trade Commission subsequently determined, these practices were 
unfair and deceptive. 
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21 . Google's terms of service stated that Google would use information given by 
Gmail users only for to provide email services. 

22. Instead, Google used this information in Buzz. 

23. Google also deceptively claimed that it would seek the consent of users before 
using their information for a purpose other than that for which it was collected. 

24. Google misrepresented the ability of users to exercise control over their 
information. 

25. Google misrepresented the extent of its compliance with the U.S.-EU Safe Harbor 
Framework by claiming that the company complied with the framework while violating the 
principles of Notice and Choice. 

EPIC's Initial Complaint with the Federal Trade Commission Gave Rise to the Subsequent 

Investigation and Final Consent Order with Google 

26. On February 16, 2010, within a week of the introduction of Buzz, EPIC filed a 
complaint with the Federal Trade Commission urging the Commission to investigate the launch 
of Google Buzz and to determine whether the company had engaged in unfair and deceptive 
trade practices, in violation of Section 5 of the FTC Act. 

27. Complainant EPIC explained that Google automatically enrolled Gmail users in 
Buzz, and subsequently disclosed users' email contacts in violation of the terms of service. 

28. There was no clear way for a user to opt out of Buzz or make information non- 
public. 

29. Furthermore, Google violated Gmail's privacy policy, which clearly stated that 
Google would only use contact lists and other related personal data to provide Gmail services. 

30. EPIC alleged that Google harmed users by violating their expectation of privacy 
in their emails, with particularly severe effects for professionals, such as lawyers, journalists, 
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and healthcare providers, who promise confidentiality. 

3 1 . EPIC's complaint urged the FTC to "enjoin [Google's] unfair and deceptive 
business practices and require Google to protect the privacy of Gmail users." 

32. Specifically, complainant EPIC urged that the FTC (1) compel Google to make 
Google Buzz a fully opt-in service for Gmail users; (2) compel Google to cease using Gmail 
users' private address book contacts to compile social networking lists; (3) compel Google to 
give Google Buzz users more control over their information by allowing users to accept or reject 
followers from the outset; and (4) provide such other relief as the Commission found necessary 
and appropriate. 

Subsequent to the filing of the Complaint by EPIC, the Federal Trade Commission 
Undertook an Investigation and Entered a Final Order Against Google 

33. On March 30, 201 1, the FTC released a Complaint and announced a proposed 
Consent Order with Google. 

34. The Commission found that Google had launched Buzz through Gmail, and that 
"options for declining or leaving the social network were ineffective." 

35. Controls for limiting the disclosure of personal information were "confusing and 
difficult to find 

36. Google also "failed to disclose adequately that consumers' frequent email 
contacts would become public by default." 

37. The FTC found that Google violated the U.S.-EU Safe Harbor Framework by 
"fail[ing] to give consumers notice and choice before using their information for a purpose 
different from that for which it was collected." 

38. In announcing the Consent Order, Jon Leibowitz, Chairman of the FTC, said, 
"when companies make privacy pledges, they need to honor them." 
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39. The FTC acknowledged the significance of EPIC's complaint in the agency's 
action: "Google's data practices in connection with its launch of Google Buzz were the subject 
of a complaint filed with the FTC by the Electronic Privacy Information Center shortly after the 
service was launched." 

40. The Federal Trade Commission opened the proposed Consent Order for public 
comment. 

41 . The FTC issued the final Consent Order on October 13, 201 1 . 

42. The Commission vote approving the final settlement was 4-0. 

43. The Consent Order contains nine parts. 

44. Part I prohibits Google from misrepresenting (a) the extent to which it "maintains 
and protects the privacy and confidentiality" of personal information, and (b) the extent to which 
it complies with the U.S.-EU Safe Harbor Framework. 

45. Part II requires Google to obtain "express affirmative consent" before "any new 
or additional sharing by [Google] of the Google user's identified information with any third party 

46. Part III requires Google to implement a "comprehensive privacy program" that is 
designed to address privacy risks and protect the privacy and confidentiality of personal 
information. 

47. Part IV requires Google to submit to independent, biennial privacy assessments, 
which are then to be provided to the FTC. 

48. Finally, Parts V-IX require Google to make copies of certain privacy-related 
documents available to the FTC, to deliver the Consent Order to all officers and directors, to 
notify the FTC thirty days before any major change in corporate structure or status that might 
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affect compliance, and to file a report with the FTC in 90 days describing compliance Google 
with the Agreement. 

Google Recently Announced Changes in Business Practices that Would Violate the Consent 

Order; the Changes will take Effect March 1, 2012 

49. On January 24, 2012, Google announced that, effective March 1, the company 
will change its terms of service, and use the personal information obtained from user in ways 
inconsistent with the original collection. 

50. Rather than keeping personal information about a user of a given Google service 
separate from information gathered from other Google services, Google will consolidate user 
data from across its services and create a single merged profile for each user. 

5 1 . Users will no longer be able to keep the personal information they provided to use 
the Google email service for simply that service; Google will be able to combine the user 
information provided for email with other Google services, including the Google social network 
service. 

52. Google stated: "Our new Privacy Policy makes clear that, if you're signed in, we 
may combine information you've provided from one service with information from other 
services. In short, we'll treat you as a single user across all our products . . .." 

53. These changes violate the Consent Order between Google and the FTC. 

54. Google violated Part 1(a) of the Consent Order by misrepresenting the extent to 
which it maintains and protects the privacy and confidentiality of covered information. 

55. Google also violated Part 1(b) of the Consent Order by misrepresenting the extent 
to which it complies with the U.S.-EU Safe Harbor Framework. 

56. Google violated Part II of the Consent Order by failing to obtain affirmative 
consent from users prior to sharing their information with third parties. 

7 



57. Google violated Part III of the Consent Order by failing to comply with the 
requirements of a comprehensive privacy program. 

The FTC Has not Enforced the Consent Order 

58. To date, the FTC has failed to take any action with respect to Google's imminent 
changes in privacy practices. 

59. The Commission has not filed a lawsuit pursuant to the Federal Trade 
Commission Act, which states that the FTC "shall" obtain injunctive relief and recover civil 
penalties against companies that violate consent orders. 15 U.S. C. § 45(1) (emphasis added). 

Count I 

Violation of the Administrative Procedure Act: Agency Action Unlawfully Withheld 

60. Paragraphs 1-59 above are hereby incorporated by reference as if set forth fully 

herein. 

61 . The FTC has failed to act to enforce the October 13, 201 1 consent order in the 
matter captioned In the Matter of Google, Inc. , FTC File No. 1 02 3 1 36. 

62. The FTC's failure to Act constitutes a final agency action. 

63. The FTC has a mandatory, nondiscretionary duty to enforce the consent order. 

64. EPIC has suffered a legal wrong and has been adversely affected and aggrieved 
by the FTC's failure to act. 

65. EPIC is entitled to injunctive relief compelling the FTC to enforce the consent 

order. 

Requested Relief 

WHEREFORE, plaintiff prays that this Court: 
A. order defendant to take all steps within the Commission's authority to enforce the 

October 13, 201 1 consent order in the matter captioned In the Matter of Google, Inc., 
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FTC File No. 102 3136 within five days of the date of the Court's Order in this matter; 

B. order defendant that such steps shall include, inter alia, commencing a civil action 
against Google, Inc. in a US district court to recover the maximum allowable civil 
penalty pursuant to 15 U.S.C. § 45; 

C. award plaintiff its costs and reasonable attorneys' fees incurred in this action pursuant to 
28 U.S.C. § 2412; and 

D. grant such other relief as the Court may deem just and proper. 



Respectfully submitted, 



Dated: February 8, 2012 



By: 

John Verdi, Esquire (DC Bar # 495764) 
Marc Rotenberg, Esquire (DC Bar # 422825) 
Khaliah Barnes 
David Jacobs 
Amie Stepanovich 

ELECTRONIC PRIVACY INFORMATION 
CENTER 

1718 Connecticut Avenue, N.W. 
Suite 200 

Washington, D.C. 20009 
(202) 483-1140 (telephone) 
(202) 483-1248 (facsimile) 



Ms. Barnes is a member of the bar of the State of Maryland. 
Mr. Jacobs' application to the bar of the State of New York is pending. 
Ms. Stepanovich is a member of the bar of the State of New York. Her application to the bar 
of the District of Columbia is pending. 
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